Skip to main content
Version: Next

Single Sign On

Homarr supports multiple authentication options, from internal userbase (credentials), to LDAP (with Active directory support), and OIDC.

Auth configuration common variables​

Environment VariableDescriptionDefault Value
AUTH_PROVIDERSSelect Which provider to use between credentials, ldap and oidc.
Multiple providers can be enabled with by separating them with ,, (ex. AUTH_PROVIDERS=credentials,oidc, it is highly recommended to just enable one provider).		credentials
AUTH_LOGOUT_REDIRECT_URLURL to redirect to after clicking logging out.---
AUTH_SESSION_EXPIRY_TIMETime for the session to time out. Can be set as pure number, which will automatically be used in seconds, or followed by s, m, h or d for seconds, minutes, hours or days. (ex: "30m")"30d"

This is the default provider.

First user is created using the onboarding process and the rest can be created by this user (see user management)

Example setups​

This example demonstrates how to use Authentik as an OIDC provider for Homarr.

User and group management is handled within Authentik. Homarr synchronizes group memberships based on OIDC claims provided by Authentik. To grant administrative privileges, create a group in Authentik (e.g., homarr-admins) and add the relevant users. The group name must match the value specified in AUTH_OIDC_ADMIN_GROUP.

Example Setup

1. Configure Authentik:

  • Create an OIDC application in Authentik for Homarr.
  • Set the redirect URIs to:
    • https://<your-homarr-domain>/api/auth/callback/oidc
    • http://localhost:3000/api/auth/callback/oidc (for local development)
  • Record the client ID, client secret, and application slug.
  • Create a group (e.g., homarr-admins) and assign users who require admin access.

2. Example .env file:

OIDC_CLIENT_ID=identificationid #OIDC client ID
OIDC_CLIENT_SECRET=secretsecretsecret #OIDC client secret
OIDC_SLUG=homarr #Application slug in Authentik
AUTH_DOMAIN=auth.example.com #Authentik FQDN
ADMIN_GROUP=homarr-admins #Authentik group for Homarr admins
HOMARR_FQDN=homarr.example.com #Homarr FQDN
SECRET_ENCRYPTION_KEY=encryptencryptencrypt #Homarr encryption key

3. Example Docker Compose configuration:

services:
  homarr:
    image: ghcr.io/homarr-labs/homarr:latest
    container_name: homarr
    restart: unless-stopped
    ports:
      - '7575:7575'
    volumes:
      - ./homarr:/appdata
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - TZ=America/Los_Angeles
      - SECRET_ENCRYPTION_KEY=${SECRET_ENCRYPTION_KEY}
      - BASE_URL=https://${HOMARR_FQDN}
      - NEXTAUTH_URL=https://${HOMARR_FQDN}
      - AUTH_PROVIDERS=oidc #(optional: include ',credentials' to keep local accounts as fallback)
      - AUTH_OIDC_CLIENT_ID=${OIDC_CLIENT_ID}
      - AUTH_OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
      - AUTH_OIDC_ISSUER=https://${AUTH_DOMAIN}/application/o/${OIDC_SLUG}/
      - AUTH_OIDC_URI=https://${AUTH_DOMAIN}/application/o/authorize
      - AUTH_OIDC_CLIENT_NAME=authentik
      - AUTH_OIDC_SCOPE_OVERWRITE=openid email profile groups
      - AUTH_OIDC_ADMIN_GROUP=${ADMIN_GROUP}
      - AUTH_OIDC_GROUPS_ATTRIBUTE=groups
      - AUTH_LOGOUT_REDIRECT_URL=https://${AUTH_DOMAIN}/application/o/${OIDC_SLUG}/end-session/
      - AUTH_OIDC_AUTO_LOGIN=true #To sign in with Authentik automatically
    networks:
      - my-network
networks:
  my-network:
    external: true

4. Additional Notes:

  • Ensure both Authentik and Homarr are accessible via the specified FQDNs.
  • The AUTH_OIDC_GROUPS_ATTRIBUTE should correspond to the claim in Authentik that contains group names (typically groups).
  • The value of AUTH_OIDC_ADMIN_GROUP must match the Authentik group name for administrative access.
  • For further information, refer to the Authentik OIDC documentation.

Additional OIDC configuration options are described in the OIDC tab above.

Tags:
Edit this page